htmlspecialchars() why does not work on some chars

Question

hi i was wondering but maybe i missed up somenthing about htmlspecialchars(), why does this function does not a replacement of all this html special character html special chars list

cause for example the char % is not replaced as i can see

the php manual says about:

 '&' (ampersand) becomes '&amp;'
    '"' (double quote) becomes '&quot;' when ENT_NOQUOTES is not set.
    "'" (single quote) becomes '&#039;' only when ENT_QUOTES is set.
    '<' (less than) becomes '&lt;'
    '>' (greater than) becomes '&gt;'

so about other chars ? no function to replace them all?

This is the subset of entities that help prevent Cross-Site Scripting attacks. Notice how most of them are characters *used in building html* - i.e. characters that have special meaning to an HTML parser/interpreter. — Ryan Kinal, Oct 11 '11 at 14:23
That's because % chars and the likes *should* not be replaced by this function. — goto-bus-stop, Oct 11 '11 at 14:23
@Ispuk: No, not at all. Language newcomers are more than welcome. We just require basic effort and reading comprehension skills; you demonstrated that you have been using the manual, but you didn't read _all_ of it. Programming ability has nothing to do with it! — Lightness Races in Orbit, Oct 11 '11 at 14:31
@reanimation so the % chars should be replaced with somenthing like substr_replace()? — itsme, Oct 11 '11 at 14:32
@Ispuk: Why do you need to replace `%` with anything at all? — Lightness Races in Orbit, Oct 11 '11 at 14:33
cause i need to make user ables to post pieces of code, and the % sometimes brokes like for example posting: for(i=0;i<300;i++) { if(i%80 == 1){ } } — itsme, Oct 11 '11 at 14:36
substr_replace, str_replace, htmlentities, etc. There's quite a lot of functions to do these things. — goto-bus-stop, Oct 11 '11 at 14:39
@Ispuk: Please use `@nick` notification format, otherwise I am not informed about your reply. I am here only by vanity and chance. More the vanity. — Lightness Races in Orbit, Oct 11 '11 at 21:55
If your HTML is ending up in [presumably] Javascript, then you have ***much* bigger problems**. — Lightness Races in Orbit, Oct 11 '11 at 21:55

score 4 · Accepted Answer · answered Oct 11 '11 at 14:20

The manual tells you everything you need to know:

Certain characters have special significance in HTML, and should be represented by HTML entities if they are to preserve their meanings. This function returns a string with some of these conversions made; the translations made are those most useful for everyday web programming. If you require all HTML character entities to be translated, use htmlentities() instead.

This function is useful in preventing user-supplied text from containing HTML markup, such as in a message board or guest book application.

The translations performed are:

'&' (ampersand) becomes '&'

'"' (double quote) becomes '"' when ENT_NOQUOTES is not set.

"'" (single quote) becomes ''' only when ENT_QUOTES is set.

'<' (less than) becomes '<'

'>' (greater than) becomes '>'

htmlspecialchars() why does not work on some chars

1 Answers1